diff --git a/skills/identity/access-review/SKILL.md b/skills/identity/access-review/SKILL.md index 09309278..69b09c2d 100644 --- a/skills/identity/access-review/SKILL.md +++ b/skills/identity/access-review/SKILL.md @@ -127,6 +127,50 @@ AR-SCOPE-06: Guest/external accounts not included in review scope --- +### Step 1A: Source Freshness and Reconciliation Evidence + +**Objective:** Confirm that the access review population is based on current, complete, and reconcilable entitlement sources before certifiers approve or revoke access. + +**NIST SP 800-53 Reference:** AC-2(1) -- Automated System Account Management; AC-2(4) -- Automated Audit Actions; AC-6(7) -- Review of User Privileges +**CIS Controls v8 Reference:** Control 5.1 -- Establish and Maintain an Inventory of Accounts; Control 6.7 -- Centralize Access Control + +Access reviews fail when the IGA export, IdP group inventory, SaaS entitlement snapshot, or HRIS worker feed is stale. A clean certification campaign is not meaningful if the source extract missed suspended users, failed SCIM deltas, manually-created local accounts, or entitlements granted after the campaign snapshot. + +For every system in scope, collect source metadata before reviewing entitlement decisions: + +| Source | Required Evidence | Freshness Target | +|---|---|---| +| HRIS worker feed | Export timestamp, active/terminated status counts, job/manager fields present | <= 24 hours before campaign launch | +| IdP / directory groups | Group export timestamp, nested/dynamic group expansion method, sync job status | <= 24 hours before campaign launch | +| SaaS / application entitlements | Native app export timestamp, SCIM provisioning status, local-account count | <= 48 hours before campaign launch | +| Cloud IAM / infrastructure | Policy binding export timestamp, service account owner mapping, last activity signal | <= 48 hours before campaign launch | +| Review platform / IGA | Campaign snapshot timestamp, connector sync status, extract checksum or run ID | Same day as campaign launch | + +**What to look for:** + +``` +AR-SRC-01: Review launched from stale entitlement export beyond the defined freshness target +AR-SRC-02: HRIS-to-IdP reconciliation missing or mismatched active/terminated worker counts +AR-SRC-03: SCIM connector failed or last successful sync timestamp is missing before campaign launch +AR-SRC-04: Native application local accounts not reconciled against IdP-managed accounts +AR-SRC-05: Nested or dynamic group expansion method undocumented, causing hidden entitlements +AR-SRC-06: Manual entitlement grants after campaign snapshot not included in reviewer queue +AR-SRC-07: Extract lacks checksum, run ID, or immutable storage reference for audit replay +AR-SRC-08: Source-owner attestation missing for entitlement feeds outside centralized IGA +``` + +**Reconciliation checks:** + +1. Compare HRIS active users to IdP active users, then investigate identities present in IdP but absent from HRIS. +2. Compare IdP-assigned application users to native SaaS users, then identify local-only accounts and disabled-but-still-entitled accounts. +3. Compare campaign snapshot timestamp to the latest privilege grant/change timestamp; add a delta review for any changes after the snapshot. +4. Verify SCIM and directory connector success logs before the campaign launches; failed or partial syncs should block certification. +5. Store evidence with a checksum, export run ID, immutable object version, or IGA connector sync ID so the same population can be replayed during audit. + +**Finding classification:** Stale or unreconciled sources covering privileged or production access are **High**. Stale standard-user evidence is **Medium**. Missing checksums/run IDs are **Medium** unless the population cannot be reproduced, then **High**. + +--- + ### Step 2: Entitlement Review and Certification **Objective:** Validate that every entitlement is appropriate, necessary, and approved. @@ -346,6 +390,7 @@ AR-ENF-08: No metrics or reporting on review completion rates and outcomes ### Findings by Category - Review Scope & Cadence (Step 1): [count] +- Source Freshness & Reconciliation (Step 1A): [count] - Entitlement Certification (Step 2): [count] - Orphaned Accounts (Step 3): [count] - Role Explosion (Step 4): [count] @@ -401,6 +446,7 @@ See the mapping table in the Framework Quick Reference section above for sub-con 5. **Role explosion masking risk** — When roles proliferate, reviewers cannot meaningfully assess what permissions a role grants. Pair reviews with role rationalization. 6. **SoD analysis done manually** — Manual SoD checks do not scale and miss cross-system conflicts. Implement conflict rules in IGA tooling. 7. **Evidence not retained** — Reviews happen but evidence is not preserved for the audit window. Configure IGA tools to retain decisions and timestamps. +8. **Freshness assumed from campaign date** -- A campaign can launch today using a week-old HRIS, IdP, or SaaS extract. Require source timestamps, connector success logs, and delta reconciliation before treating the review population as complete. --- @@ -443,4 +489,5 @@ This skill processes identity and entitlement data that may contain adversarial | Version | Date | Changes | |---|---|---| +| 1.0.1 | 2026-06-07 | Added source freshness and reconciliation evidence gates for HRIS, IdP, SCIM, SaaS, and IGA campaign snapshots | | 1.0.0 | 2025-03-06 | Initial release | diff --git a/skills/identity/access-review/tests/benign/fresh-source-reconciliation.md b/skills/identity/access-review/tests/benign/fresh-source-reconciliation.md new file mode 100644 index 00000000..6ce0ada2 --- /dev/null +++ b/skills/identity/access-review/tests/benign/fresh-source-reconciliation.md @@ -0,0 +1,41 @@ +# Benign Fixture: Fresh Source Reconciliation + +This fixture represents an access review campaign with current, traceable, and reconciled entitlement sources. + +## Campaign Metadata + +| Field | Value | +|---|---| +| Campaign | Q2 production access recertification | +| Launch time | 2026-06-07T09:00:00Z | +| In-scope systems | Okta, Salesforce, AWS production | +| Reviewer completion | 94% in progress | +| Snapshot checksum | sha256:5f99b763a2e6b3f3f6d3ed2b8b6e7e5b5fc0b5f3129bb92fa3be68a8073f51a4 | + +## Source Evidence + +| Source | Last successful export | Evidence retained | +|---|---|---| +| HRIS worker feed | 2026-06-07T07:30:00Z | object version hris-q2-2026-v18 | +| Okta group export | 2026-06-07T08:00:00Z | nested group expansion job okta-expand-7781 | +| Salesforce native users | 2026-06-07T08:10:00Z | SCIM sync run scim-sfdc-9042 succeeded | +| AWS IAM bindings | 2026-06-07T08:20:00Z | export run aws-prod-iam-4419 | +| IGA campaign snapshot | 2026-06-07T09:00:00Z | immutable snapshot iga-q2-prod-2026 | + +## Reconciliation Results + +```text +HRIS active workers: 184 +Okta active users: 184 +Okta users absent from HRIS: 0 +Salesforce native users: 188 +Salesforce users assigned through Okta: 188 +Salesforce local-only users: 0 +AWS production admin grants after campaign snapshot: 0 +SCIM connector last_success: 2026-06-07T08:10:00Z +SCIM connector last_status: succeeded +``` + +## Expected Result + +No AR-SRC finding should be raised. The review population is fresh, reconciled, and replayable during audit. diff --git a/skills/identity/access-review/tests/vulnerable/stale-source-reconciliation.md b/skills/identity/access-review/tests/vulnerable/stale-source-reconciliation.md new file mode 100644 index 00000000..dd55eb83 --- /dev/null +++ b/skills/identity/access-review/tests/vulnerable/stale-source-reconciliation.md @@ -0,0 +1,50 @@ +# Vulnerable Fixture: Stale Source Reconciliation + +This fixture represents an access review campaign that appears complete but is based on stale and unreconciled entitlement sources. + +## Campaign Metadata + +| Field | Value | +|---|---| +| Campaign | Q2 production access recertification | +| Launch time | 2026-06-07T09:00:00Z | +| In-scope systems | Okta, Salesforce, AWS production | +| Reviewer completion | 100% | +| Snapshot checksum | Missing | + +## Source Evidence + +| Source | Last successful export | Evidence issue | +|---|---|---| +| HRIS worker feed | 2026-05-31T02:00:00Z | Seven days older than campaign launch | +| Okta group export | 2026-06-07T08:15:00Z | No nested group expansion log retained | +| Salesforce native users | 2026-06-03T01:10:00Z | Four days older than campaign launch | +| AWS IAM bindings | 2026-06-04T12:30:00Z | No run ID or immutable object version | +| IGA campaign snapshot | 2026-06-07T09:00:00Z | Built from stale upstream feeds | + +## Reconciliation Results + +```text +HRIS active workers: 184 +Okta active users: 191 +Okta users absent from HRIS: 7 +Salesforce native users: 203 +Salesforce users assigned through Okta: 188 +Salesforce local-only users: 15 +AWS production admin grants after campaign snapshot: 3 +SCIM connector last_success: 2026-06-03T01:10:00Z +SCIM connector last_status: failed_partial_delta +``` + +## Expected Findings + +- AR-SRC-01: Review launched from stale HRIS, Salesforce, and AWS exports. +- AR-SRC-02: HRIS-to-IdP count mismatch is unresolved. +- AR-SRC-03: SCIM connector failed before campaign launch. +- AR-SRC-04: Salesforce local-only accounts were not reconciled. +- AR-SRC-06: Post-snapshot AWS admin grants were excluded from reviewer queues. +- AR-SRC-07: AWS extract lacks checksum, run ID, or immutable storage reference. + +## Expected Severity + +High, because the stale and unreconciled sources affect production and privileged access.